How should we share the OpenPGP private key between devices?
The situation right now is that the OpenPGP private key is stored in soledad encrypted with the user password. This is far from being ideal.
Some ideas
- Have the key encrypted with some random string different than the user password that is only needed on sync time. We could use QR codes or something to make the user experience easier.
- Open a direct channel between the two devices to sync the keys. The two devices have to be only at the same each time the private key changes.
- Make easy to export/import keys and let the user do it with usb-stics or other offline sync method.
- "Separate signing keys, shared encryption key":https://github.com/coruus/zero-one/blob/master/multidevice-keysync.markdown#separate-signing-keys-shared-encryption-key. Does that has any benefits for us? I have the feeling that is too complicated for the small improvement on security that we will gain.
- Warn existing devices of a new device sync, having the knowledge that new device has access to your account could help to detect compromised accounts.
I have the feeling that we should do a combination of some of them. Not sure if we should let the user to choose their security needs by doing something user friendly by default and making easy to change it to some more secure but inconvenient.
How other projects are dealing with this problem
- Storing the keys in the IMAP server encrypted with a random string: https://github.com/whiteout-io/mail-html5/wiki/Secure-OpenPGP-Key-Pair-Synchronization-via-IMAP
- Key in the dovecot server: https://github.com/posteo/scrambler-plugin
- Firefox sync problems (I think is mainly UX): https://blog.mozilla.org/warner/2014/04/02/pairing-problems/
- status review by coruus: https://github.com/coruus/zero-one/blob/master/multidevice-keysync.markdown
(from redmine: created on 2015-04-10)